Mirai Botnet Creator Ordered To Pay $8.6M for Rutgers DDoS Attacks

A federal court has ordered Mirai botnet creator Paras Jha to pay $8.6 million to Rutgers University for distributed denial of service (DDoS) attacks on the university’s networks.

Jha also must serve six months of home detention for the DDoS campaign carried out between November 2014 and September 2016, which shutdown the university’s central authentication server.

The server maintained the gateway portal through which staff, faculty, and students exchanged assignments and assessments. The DDoS attacks took the portal offline on a number of occasions.

Jha, along with Josiah White and Dalton Norman, plead guilty in December last year to creating and operating the Mirai botnet, which recruited Internet of Things devices to launch DDoS attacks.

The defendants uncovered vulnerabilities that allowed them to surreptitiously attain administrative or high-level access to victim devices for the Mirai botnet.

The Mirai botnet at its peak enslaved hundreds of thousands of compromised IoT devices. Jha subsequently posted the source code online in the fall of 2016.

On Sept. 18, 2018, a federal court sentenced all three defendants to five year’s probation and 2,500 hours of community service. They were ordered to pay restitution in the amount of $127,000 and to abandon cryptocurrency seized during the course of the investigation.

Jha, Norman Plead Guilty to More Charges

Jha and Norman also plead guilty to successfully infecting more than 100,000 U.S.-based Internet-connected computing devices with malware between December 2016 and February 2017.

The two then used the compromised devices as a network of proxies through which they routed Internet traffic. The victim devices were used primarily in “clickfraud,” a type of Internet-based scheme that utilizes “clicks,” or the accessing of URLs and similar web content, for the purpose of artificially generating revenue.

Last month, European law enforcement agency Europol warned that DDoS attackers were targeting critical infrastructure. Europol said that DDoS attacks were becoming more accessible and involved low cost and low risk for attackers.